CVE-2020-5504 phpMyAdmin SQL injection in user accounts page
Authenticated users can inject SQL via username fields in phpMyAdmin, allowing unauthorized database access or modification.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-5504?
CVE-2020-5504 is a high-severity SQL injection vulnerability in Debian Debian Linux, published on 9 Jan 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server.
Weakness: CWE-89
Which versions are affected by CVE-2020-5504?
5 open source packages ship an affected version, including phpmyadmin/phpmyadmin and phpmyadmin. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
phpmyadmin/phpmyadmin Packagist | From 4.0.0 | 4.9.4 |
phpmyadmin/phpmyadmin Packagist | From 4.0.0 | 4.9.4 |
phpmyadmin/phpmyadmin Packagist | From 5.0.0 | 5.0.1 |
phpmyadmin/phpmyadmin Packagist | From 5.0.0 | 5.0.1 |
phpmyadmin Bitnami | From 4.0.0 | 4.9.4, 5.0.1 |
Products include Debian Debian Linux, Phpmyadmin Phpmyadmin, Suse Suse Linux Enterprise Server.
How do I fix CVE-2020-5504?
Upgrade phpmyadmin/phpmyadmin to a fixed version for your release line: 4.9.4 or 5.0.1.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2020-5504 being exploited?
There is no known exploitation of CVE-2020-5504 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 2 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BIT-phpmyadmin-2020-5504, DEBIAN-CVE-2020-5504, DLA-2060-1, GHSA-fgj8-93xx-f6g6, MGASA-2020-0033, UBUNTU-CVE-2020-5504.